The Longitude Problem: Why Ground Truth Beats Guesswork in the AI Age
For centuries, sailors died because they could estimate their position but not confirm it. Attackers targeting your company today face the same gap, and your best defence is the same one that finally solved navigation.
Key points
- Criminals targeting businesses today largely work from guesswork, piecing together who approves payments and which email domains are real from publicly available clues.
- AI-generated phishing emails can now pass every spelling check and tone check defenders once relied on.
- Defenders hold an asymmetric advantage: they can access ground truth, confirmed internal facts that attackers must guess at from the outside.
- Maintaining that ground truth, keeping records of who actually authorises payments and which domains your company owns, is the practical work that turns the advantage into protection.
- A single confirmed fact can kill a sophisticated fraud attempt that defeated every other filter.
What does an eighteenth-century navigation crisis have to do with your inbox?
Ships once knew how far north or south they were. East to west was a guess, and wrong guesses meant shipwrecks. After a British fleet wrecked on home rocks in 1707, Parliament offered a prize of up to 20,000 pounds for a solution.
The answer came not from a smarter calculation but from a better fact. A self-taught carpenter named John Harrison built a clock precise enough to hold Greenwich time across months at sea. Compare that time to local noon, do the arithmetic, and your position stops being a probability. It becomes a statement. Harrison's fourth timekeeper sailed to Jamaica in 1761 and, after 81 days at sea, had lost five seconds.
CSO Online drew that parallel to modern security, and it holds.
How do attackers actually target a company today?
They guess. Criminals scrape job listings and company websites to build a picture of who approves wire transfers, which domains belong to the organisation, and what normal internal messages look like. That picture is assembled from the outside, often out of date, never fully confirmed.
AI makes the guesses more convincing. A model can now write a message from a fake CFO with perfect grammar and a plausible email thread. Every filter passes it, every reputation check clears it, because nothing looks unusual on the surface. Our earlier story on hidden text planted in emails to manipulate AI summarisers, published 1 September, shows how the manipulation can survive even tools defenders trust.
What kills a fraudulent message is a fact.
What does 'ground truth' mean in practice?
Ground truth, in this context, means a confirmed internal record: the actual list of who is authorised to approve a payment, the exact set of email domains your company owns, the vendors that genuinely exist in your supplier list.
A system holding those facts doesn't need to decide whether a message looks suspicious. It checks whether the message contradicts something already known to be true. If the person named as approver isn't the approver of record, and the reply address isn't one of your registered domains, the fraud dies on a fact rather than a hunch.
That advantage is real but not permanent.
Should organisations be worried about keeping those records current?
Yes. Ground truth decays. Approvers change jobs, domains accumulate as business units grow, vendors get added without being logged centrally. A fact nobody maintains quietly becomes an out-of-date guess wearing a confident face.
Keeping those records accurate is the hard, unglamorous work. It's the equivalent of winding every chronometer on every ship, not just the flagship.
For anyone deciding where to start: identify who in your organisation can actually authorise a payment. Confirm it. Write it down. Confirm it again next quarter. Attackers are computing a plausible version of that answer from the outside. The question is whether your defences are still doing the same thing beside them, or carrying the fact instead.
Common questions
Would better email filters stop these attacks?
Not reliably. AI-written messages can pass grammar and tone filters because they're well-written. Detection based on ground truth, checking confirmed internal facts rather than surface patterns, is what stops messages that look legitimate but contradict what you know.
Does multi-factor authentication, the extra login step beyond a password, help here?
For account takeover it's essential. For social engineering fraud where a criminal impersonates a known colleague by email rather than logging in, it doesn't help directly. Verified internal records of who can authorise what are the relevant control.
